690d258f4e9f86ecdc551a268db098c3a3029866f31d96cdc1177c49c6e5f27b

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 07:16

Target

690d258f4e9f86ecdc551a268db098c3a3029866f31d96cdc1177c49c6e5f27b.exe
Size

210KB
MD5

0da78b6b371fdf8688009e20cf37ceb0
SHA1

380059acac2164b762bb8a042888cea075045780
SHA256

690d258f4e9f86ecdc551a268db098c3a3029866f31d96cdc1177c49c6e5f27b
SHA512

b7e56494c9462aefea4a7cb07c5175a650ae7d5910f120826f32915e478ff9269d3d46999ff44b8bece2ae8cafc71c24f74841d49319cf529c61407ceb2e65ca
SSDEEP

3072:sPUfyo6aRh6CzNiof2HtA2PtLR34PQhVDYwNXKakdyvlJeGhsYa/YWGGXHjf/Rgr:sagCxLf2NA0tK4XDYwNp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1268	1468	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 1268	1468	690d258f4e9f86ecdc551a268db098c3a3029866f31d96cdc1177c49c6e5f27b.exe	28
PID 1468 wrote to memory of 1268	1468	690d258f4e9f86ecdc551a268db098c3a3029866f31d96cdc1177c49c6e5f27b.exe	28
PID 1468 wrote to memory of 1268	1468	690d258f4e9f86ecdc551a268db098c3a3029866f31d96cdc1177c49c6e5f27b.exe	28
PID 1468 wrote to memory of 1268	1468	690d258f4e9f86ecdc551a268db098c3a3029866f31d96cdc1177c49c6e5f27b.exe	28

C:\Users\Admin\AppData\Local\Temp\690d258f4e9f86ecdc551a268db098c3a3029866f31d96cdc1177c49c6e5f27b.exe
"C:\Users\Admin\AppData\Local\Temp\690d258f4e9f86ecdc551a268db098c3a3029866f31d96cdc1177c49c6e5f27b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 92
  2⤵
  - Program crash
  PID:1268

memory/1468-55-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download